The authorities in Germany have warned the country is facing the threat of terror attack after an arrest over an alleged plot to blow up two trains.
German police released security camera footage on Friday
The head of the federal crime office, Joerg Ziercke, said the hunt was on for a second suspect and the danger was "still out there".
Prosecutors said details of the plot suggested the two had not acted alone.
They appeared to be part of a terrorist group intent on carrying out serious acts of violence in Germany, they said.
The man arrested at Kiel, in the north, early on Saturday is a 21-year-old Lebanese student.
Two bombs were discovered on trains in the cities of Dortmund and Koblenz three weeks ago.
Security has since been stepped up at German airports and the rail authorities have announced they are installing more closed circuit TV cameras at stations.
The arrest of the student follows the release of closed circuit TV footage of two male suspects by police on Friday.
Faulty construction may be why the devices failed to go off
The devices in abandoned suitcases on two trains failed to go off. Police said the bombers had intended to kill large numbers of people.
The student has been in Germany since 2004.
Chief prosecutor Monika Harms said he had apparently been planning to flee the country.
Reports say police searched his home in the city on Saturday afternoon.
He is believed to be "one of the two suspects that have been sought since yesterday with the help of video footage that was made public", the public prosecutors' office said.
In the video, the two suspects - dark-haired young men - are seen wheeling suitcases at Cologne station.
Mr Ziercke told reporters he was confident that "the right suspected bomb-planter" had been caught.
"The second suspect is still at large," he added, speaking in Kiel.
"The danger is still out there."
Investigators first thought the bombs were part of a blackmail attempt but they now believe the incident was the work of a terrorist group based in Germany.
A note written in Arabic, a telephone number in Lebanon, and packets of starch with labels in Arabic and English were found alongside the devices.
The authorities say they are investigating a possible link to Lebanon, but they also have not ruled out a link to Pakistan.
The identical suitcase bombs were fitted with timers set to go off 10 minutes before the trains arrived in Dortmund and Koblenz.
Police think they failed to detonate because of a construction flaw.